From 0d2237402ea1df459ce89e2bf571da2c32e852df Mon Sep 17 00:00:00 2001 From: Björn Stenberg Date: Thu, 4 Dec 2003 14:06:00 +0000 Subject: Buffer overrun fix by Craigh Sather (#852494) git-svn-id: svn://svn.rockbox.org/rockbox/trunk@4106 a1c6a512-1295-4272-9138-f99709370657 --- apps/wps-display.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) (limited to 'apps') diff --git a/apps/wps-display.c b/apps/wps-display.c index 563bb265be..846cea20d9 100644 --- a/apps/wps-display.c +++ b/apps/wps-display.c @@ -120,7 +120,7 @@ static void wps_format(char* fmt) format_buffer[sizeof(format_buffer) - 1] = 0; format_lines[line] = buf; - while (*buf) + while ((*buf) && (line < MAX_LINES)) { switch (*buf) { @@ -134,7 +134,7 @@ static void wps_format(char* fmt) if(*start_of_line != '#') /* A comment? */ line++; - if (line <= MAX_LINES) + if (line < MAX_LINES) { /* the next line starts on the next byte */ format_lines[line] = buf+1; @@ -145,13 +145,19 @@ static void wps_format(char* fmt) buf++; } - if(buf != format_lines[line]) - /* the last line didn't terminate with a newline */ - line++; - - for (; line < MAX_LINES; line++) + /* if supplied input didn't define a format line + for each line on the wps, set the rest to null */ + if (line < MAX_LINES) { - format_lines[line] = NULL; + /* if the final line didn't terminate with a newline, + the line index wasn't incremented */ + if (buf != format_lines[line]) + line++; + + for (; line < MAX_LINES; line++) + { + format_lines[line] = NULL; + } } } -- cgit v1.2.3